Essential Eight MF-ML2.8 Timely analysis of event logs from internet-facing servers
What it says
Event logs from internet-facing servers are analysed in a timely manner to detect cybersecurity events.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishRegularly check logs from online servers to quickly spot security issues.
Regularly checking the logs from your internet-facing servers is akin to keeping an eye on your store's front door. If you don't review them frequently, you might miss signs of a cyber attack that could harm your business. By examining these logs promptly, you can catch potential security threats early before they cause severe damage.
Free. Save your status, tasks and notes.
Why it matters
If internet-facing server logs aren't analysed promptly, intrusions and suspicious activity may go unnoticed, increasing the chance of data theft, malware spread or service disruption.
How to implement
Security officer: Establish a schedule for when event logs should be analysed, ensuring it's a regular task.
IT team: Set up automated alerts for unusual activity in event logs from internet-facing servers to ensure prompt detection.
System administrator: Use a log management tool to collect and consolidate logs, making analysis more efficient.
IT manager: Allocate resources and time for staff to analyse event logs consistently as part of their routine duties.
Keep it running
Review internet-facing server logs daily (or near real-time) via SIEM; alert on suspicious auth, web errors and admin changes, and escalate confirmed incidents within defined timeframes.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How often are the logs from your internet-facing servers reviewed?
Look at
Examine the calendar or schedule showing planned log review dates and times.
Good evidence
Logs are reviewed daily or weekly, with a set schedule visible.
- Check 2 of 2What an auditor asks for
Ask for
What happens if an unusual event is detected in the logs?
Look at
Check for documentation of response procedures or previous incidents.
Good evidence
There is a clear, documented process to investigate abnormal log entries, with past examples of successful resolution.
Mappings
Closest match in ASD Information Security Manual: ISM-1906, Timely analysis of internet-facing server logs, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.15.
E8-MF-ML2.8 requires timely analysis of event logs specifically from internet-facing servers to detect cyber security events. Annex A 8.15 requires logs to be produced, stored, protected and analysed across activities, exceptions and faults, which includes (but is not limited to) internet-facing server logs. E8-MF-ML2.8 is a more specific application of Annex A 8.15 focused on a particular asset class and timeliness for detection.
This control partially meets A.8.16.
E8-MF-ML2.8 focuses on timely analysis of event logs from internet-facing servers to detect cyber security events. Annex A 8.16 requires monitoring of networks, systems and applications for anomalous behaviour and taking actions to evaluate potential incidents, which can be implemented using log analysis among other telemetry. E8-MF-ML2.8 is one specific monitoring mechanism that contributes to meeting the broader monitoring requirement in Annex A 8.16.
ASD Information Security Manual: 12 mappings
This control is equivalent to ISM-1906.
E8-MF-ML2.8 requires event logs from internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1906 states the same requirement with the same scope (internet-facing servers) and the same intent (timely detection). Implementing E8-MF-ML2.8 would largely satisfy ISM-1906 and vice versa.
This control is broader than ISM-1228.
E8-MF-ML2.8 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-1228 is broader, requiring cyber security events to be analysed in a timely manner to identify incidents, regardless of the source of the event data. E8-MF-ML2.8 fits within ISM-1228 as a specific log-driven detection and analysis activity for a defined system category.
This control partially meets ISM-1987.
ISM-1987 requires event logs from security products to be analysed in a timely manner to detect cyber security events. E8-MF-ML2.8 mirrors this intent but narrows scope to event logs from internet-facing servers. As a result, E8-MF-ML2.8 is a specific subset of the broader monitoring and detection expectation in ISM-1987.
This control partially overlaps ISM-0634.
E8-MF-ML2.8 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-0634 requires central logging of security-relevant gateway events and real-time intrusion alerts, which are closely related to detecting attacks against internet-exposed services. They overlap on detection and log use, but ISM-0634 is gateway-centric and emphasises central logging/alerting, whereas E8-MF-ML2.8 is server-log analysis-centric.
This control partially overlaps ISM-1030.
E8-MF-ML2.8 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-1030 requires deploying a NIDS/NIPS inside the outermost firewall and generating logs/alerts for traffic that contravenes firewall rules, which contributes additional detection telemetry relevant to internet-facing exposure. They overlap on monitoring and detection via log review, but ISM-1030 focuses on gateway network traffic controls rather than server event log analysis.
This control partially overlaps ISM-1907.
ISM-1907 requires timely analysis of logs from non-internet-facing servers to detect cyber security events. E8-MF-ML2.8 addresses timely analysis too, but for internet-facing servers rather than non-internet-facing servers. They overlap in the logging/monitoring activity and detection objective, but differ materially in the asset scope being monitored.
This control partially overlaps ISM-1961.
E8-MF-ML2.8 requires organisations to analyse event logs from internet-facing servers in a timely manner to detect cyber security events. ISM-1961 similarly requires timely analysis of event logs, but it applies to non-internet-facing network devices rather than internet-facing servers. They align on the detection objective and timeliness expectation, but differ materially in asset scope (server vs network device; internet-facing vs internal).
This control partially overlaps ISM-1986.
ISM-1986 requires event logs from critical servers to be analysed in a timely manner to detect cyber security events. E8-MF-ML2.8 mandates timely analysis of logs from internet-facing servers, including some critical servers. ISM-1986 is driven by server criticality, while E8-MF-ML2.8 is driven by exposure (internet-facing).
This control supports ISM-0580.
ISM-0580 requires an organisation to develop, implement and maintain an event logging policy to ensure events are recorded and monitored. E8-MF-ML2.8 requires timely analysis of logs from internet-facing servers, which is a specific monitoring practice that the ISM-0580 policy would direct and formalise (coverage, timeframes and accountability). ISM-0580 is not limited to internet-facing systems, whereas E8-MF-ML2.8 is scoped to that subset.
This control depends on ISM-0988.
E8-MF-ML2.8 requires organisations to analyse event logs from internet-facing servers in a timely manner to detect cyber security events. ISM-0988 requires an accurate and consistent time source for event logging, which is a prerequisite for reliable correlation, triage and sequence-of-events analysis when reviewing those logs. Without ISM-0988, E8-MF-ML2.8 analysis outcomes can be misleading due to timestamp drift and inconsistent timelines.
This control depends on ISM-1405.
E8-MF-ML2.8 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-1405 mandates implementing a centralised event logging facility, which underpins timely analysis by aggregating, protecting and making logs available for review and correlation. E8-MF-ML2.8 is the operational detection activity, while ISM-1405 is foundational logging infrastructure that is typically a prerequisite for doing it consistently.
This control depends on ISM-1978.
E8-MF-ML2.8 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-1978 requires security-relevant events for server applications on internet-facing servers to be centrally logged, which makes those logs accessible and actionable for timely review. While analysis could occur without central logging, in practice E8-MF-ML2.8 commonly depends on ISM-1978-style centralisation to ensure completeness, retention and efficient triage at scale.
ASD Essentials for enterprise IT: 1 mapping
This control partially overlaps IT.DET-03.1.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-MF-ML2.8 requires event logs from internet-facing servers to be analysed in a timely manner to detect cyber security events, one source of the events to be triaged.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.